Unintended Require in larvitbase-api

ÉLEVÉE 7.5CVE-2019-5479 · GHSA-xf27-jqwv-gf3r · Published 03/09/2019 · updated 17/06/2026

En bref

CVE-2019-5479 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant larvitbase (larvit), larvitbase-api.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.3%, plus élevée que 70.4% des vulnérabilités.
Correctif : mettre à jour vers 0.5.5 ou plus récent.

Package	Affected versions	Patched versions
larvitbase larvit	`< 0.5.5`	`0.5.5`
larvitbase-api npm	`< 0.5.5`	`0.5.5`

Description

Versions of larvitbase-api prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require() call. This allows attackers to execute any .js file in the same folder as the server is running.

Recommendation

Upgrade to version 0.5.4 or later.

NVD description

An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).

References

nvd.nist.gov/vuln/detail/CVE-2019-5479 · ADVISORY
hackerone.com/reports/566056 · WEB
npmjs.com/advisories/1120 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free